Lucene search
Redhat.comRH:CVE-2019-0192HistoryOct 10, 2019 - 5:40 p.m.
CVE-2019-0192
2019-10-1017:40:21
redhat.com
access.redhat.com
45
EPSS
0.948
Percentile
99.3%
A flaw was found in the Apache Solr’s Config API, where it would permit the configuration of the JMX server via an HTTP POST request. An attacker could use this flaw to direct traffic to a malicious RMI server, and then trigger remote code execution or conduct further attacks.
Mitigation
- Upgrade to 6.6.6 or later
- Disable the ConifgAPI if not in use (
disable.configEdit=true) - Use other external means to ensure only trusted traffic is allowed (block POST requests to the config API from external sources)
Related
ibm
ibm
Security Bulletin: A vulnerability in Apache Solr affects IBM InfoSphere Information Server
2019-06-27 23:45:01
Security Bulletin: Potential vulnerability related to Unsafe Deserialization in Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2019-0192)
2019-04-23 04:50:01
Log Analysis Security Bulletin List
2021-09-01 11:04:11
osv
osv
CVE-2019-0192
2019-03-07 21:29:00
Critical severity vulnerability that affects org.apache.solr:solr-core
2019-03-14 15:39:45
nvd
nvd
CVE-2019-0192
2019-03-07 21:29:00
veracode
veracode
Remote Code Execution (RCE)
2019-03-08 03:28:52
debiancve
debiancve
CVE-2019-0192
2019-03-07 21:29:00
ubuntucve
ubuntucve
CVE-2019-0192
2019-03-07 00:00:00
nessus
nessus
Apache Solr 5.x <= 5.5.5 or 6.x <= 6.6.5 Deserialization Vulnerability (CVE-2019-0192)
2019-07-03 00:00:00
Apache Solr 5.x <= 5.5.5 or 6.x <= 6.6.5 Deserialization Vulnerability
2019-03-27 00:00:00
Oracle Primavera Unifier Multiple Vulnerabilities (Jul 2019 CPU)
2019-07-19 00:00:00
checkpoint_advisories
checkpoint_advisories
cvelist
cvelist
CVE-2019-0192
2019-03-07 21:00:00
github
github
Critical severity vulnerability that affects org.apache.solr:solr-core
2019-03-14 15:39:45
prion
prion
Remote code execution
2019-03-07 21:29:00
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Solr
2019-11-01 13:46:37
cve
cve
CVE-2019-0192
2019-03-07 21:29:00
hackerone
hackerone
U.S. Dept Of Defense: Remote Code Execution on █████████
2020-08-19 04:07:49
thn
thn
Linux Botnet Adding BlueKeep-Flawed Windows RDP Servers to Its Target List
2019-07-25 09:38:00
redhat
redhat
(RHSA-2019:2413) Important: Red Hat Fuse 7.4.0 security update
2019-08-08 10:07:26
oracle
oracle
Oracle Critical Patch Update Advisory - July 2019
2019-07-16 00:00:00
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00